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Significantly enhanced the performanc2 capabilities of 
modern fighter/attack aircraft. In consonance with the 


military services survivability |. policy, a series of 


Survivability design guidelines for Fly-By-wWire Flight 
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I. INTROD UCTION 


A. Comey tT eoURVEVABLIEITY..«.A TECHNOLOGY ISSUE 

In the skies today and on ths drawing hoards tor 
momerclOw are Military aircratt that are technological 
marvels. The F-165, and F/A-18 are superior fidchter ard 
at<ack aircraft ‘that employ the very latest in 
State-of-the-art technologies in computers, flight control 
systems, ¢ngines, and structural materials. Thes= machines 
have been optimized to levels heretofors unobtainable. 


Performance has bean built-in *o these aircraft. Ard so has 


> 


Pemecning GlSS,..e.e.-SULViVabili*y. Thes aircraf. wer: 
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designed te perform their assigned combat missions in th 
face of modérn arsenals and tc return 79 their bases to fly 
again. However, the question must b= asked, have these 
@ircraft designs realized the utmost in survivability 
benefits *hat modern digital systems tachnologies have “to 
Se Lec? 

Because history has shown that the importance of 
Survivability has sometimes been forgotten or neglected in 
“he design and dévelopment of military aircraft in 
peacetime, it is incumbent upon the aircaft designer, «he 


military program manager, and the combat aviator *9 ensure 
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icaticn cf computer augmented flight contre 
continue to vrovide the survivability enhancement features 


that will keep «he cutting €¢dge of our nation's dafense 


keen. 


3. Meese PL LCIETARY SURVIVAPILITY POLICY 


Survivability has been increasingly emphasized b 
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U.S. Armed Services in recen= years. The Depa 
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Defense and the Military Service Branch=s have established 
PebmeesurVvivabilicty policies regarding arms acquisitions. 
The primary objective of the U.S. Military Survivability 
Policy is to ensure that effective survivaoility enhancemen= 
features are incorporated in current and all cuture U. S. 
weapcns systems. 


) Pen aee 


in 
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Fvice organization, the Joint Technical 
Seeece tating. Group on Aircraft Survivability (JTCS/AS), 


created in 1971, has brought together the pest expertise in 


2aach of the service Dranches tc plan andi =xecuts 
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comprehensive program to increase the survivability of 
current and future aircraft assets. Within ths JTCG/SAS 


charter are tasks to develop design criteri 
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improved 
technology to increase the survivability of future combar 
aircraf+ and weapons systems. 
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Cs Suey ee eeiy Y ASOULREMENTS/GUIDELINES/STAWNDARDS 
Survivability requirements for airborne weapon systems 
have bean specified in different ways by ¢ach branch of the 
Acmed Services. The Navy establishsi AEPONAUTICAL 
REQUIREMENT (AR) ~107, "Navy Percae. & 
Survivability/Vulnerability (Nuclear/Nennuclear)," in 3974. 
meL-STD-2072 (AS) , "Military Standard: SUmvevaosei: ¥, 
Meretar-; Establishment and Conduct of Progréems for," 
superseded AR-107 in 1977. Piolo, §ih= DepaGem=en- of 


Defense issued MIL-STD-2069, "Requiréments for Aircralit 


(D 


NOnnuclear Survivability Programs." Each dccument was 
prepared in reccgnition cf the need for a standardized 


systems approach £9 improving the survivabili- 
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melitary aircraft. 

DOD MIL-STD-2069 provided guidelines and requirements 
£90 establishing and conducting aircraft survivability 
PaOgmetis.m Apprbecabilaty cf the princaples contained zherein 


apply to all major weapons system acquisition pregrams and 


j-- 


S$ «he standard inveksd in contractual agr2ements regarding 
aircraft armaments. 


Various forms of handbooks have been prepared to provide 


(D 


Military planners and industrial designers with th 
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oMeOrMet. On and guidance Heeded in incorporating 


Survivability features into new and existing systems. The 


(Dp 


Airc Force Systems Command has published a design handbock 
series, DH-1 through DH-3 (with supplements fort use wit! 
Air Force pregrams. The Army has publisaed a "Surviv2abilicy 
Design Guide for Army Aircratt,"™ USAAMRDL 2R-71-41. Tae 
Navy estaklished MIL-HDBK-268 (AS), WS ieewira bs. y 


Enhancement, Aircraft Conventional Weapons Threats, bDBesiaqn 


and Evaluation Guidelines," in August 1982 fos us? in the 


aw 


acquisition process of Naval aircraft systems. Jointly, th 


(|) 


three services work within the guidelines established by th 
JTCG/AS and published in several volumes as 
Pee HDBK-e@56, "“"Sisvivability, Aircr2ft, Wonnuclear, 


(Various)." 


Ds WHY BE CONCERWED WITH AIRCRAFT FLIGH? CONTROL SYST&MS? 
The essential question of flight control survivability 


was derived by the author from a s+ 


pw 


temane smanating From an 
analysis of Southeast Asia combat files naintained by «he 
Combat Data and Information Center (CDIC). The sta zemenz 
attributed approximately 25% of all aircraft lost in 
Soucheast Asia to the functional loss of the aircraft's 


Flight control system as a result of combat induced damegse. 
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percentage figur2 equated =o nea 


Preliminary investigation revealed that tha flight sontrel 
system of most conventional combat @ircraft contributed 
Mgpacet Maccly 5% tO the aircraft's total presented area. 
ime d2sproportionality of the two figures generated «4 


concern that culminated in the davelopment of the guidelines 


Moncained herein. 


Ee PURPOSE 

The purpose of this treatise? is t> present in a single 
document guidelines for the development cf aircraft flight 
control systems (FCS) with specific emphasis on increasing 


the combat survivability of aircraft equipoed with 


Fly-By-Wire (FEW) flight control systems. 


Fe SCOPE 

The scores of this effert was limit2d to nonnuclear 
weapons effects considerations. Thevw ely-bDy-Wire flign= 
control systems development guidelines presented within were 
developed in cennection wit the damage causing mechanisms 


associated with conventional weapons systems, selrI aenerated 


(p 


electromagnetic interference (EMI) ph¢enomena, and normal 
inflight eéenvironmental/meteorological sonditions t+5 be 


expected in *he conba* aircraft's operéting environnent. 
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II. FUNDAMENTAL SURVIVABILITY CONCEPTS 


A. Ve eo eee RAPT COMBAT SURVIVABILITY? 


Aircraft combat survivability has bsen defined as "the 


Smuabllity Of en aeirecsaft (weapon syst2m) to avoid ard/for 
withstand a man-made hosti1l2 eéenvironmant" (Ref. 1]. 
Paramount in this definition is the ability "-s avoid and/or 
withstand." Lice ory, =O. avoid," th= hkoscils 


environment is referred to as susceptibility. Tht inability 
"to withstand," the hostile environmert is referresi to as 
vulnerability. 


Susceptibility, often measured as the prebability cf 
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being hit, Ph, can be divided into thre eneréai cateéegori 
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(1) Defensive weapon system thr22¢ activity 

(2) Detection, identification, and tracking by 

defensive weapon systems 

(3) Engagement by defensive w2apon systems (1.¢., 

missile launch or gun firing; warhead guidance; 

warhead imoact or detonation) 

The susceptibility of an aircraft can be influénced by 

Pmewde@scras. "Ss Signatures, the tactics and supporting forces 
employed, and th® integral survivability enhancenent 


SdU2oment Carried on or within the aircraft. Small size, 
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Miemeeeod Maneuvyerability, low visual/radar/anral/infrersé 
Peete sw-ssn5e.Nn Maskang/tSrrain following tactics, 
active/passive alectronic countermeasures, decoys, and 


antiradiation missiles are but a limiz 
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means to reducé an aircraft's susceprtibiliczy. 
Vulnerability, often measured as =he probabiliczy cf 

being killed if hit, DPk/h, is a direct function and measure 

of the aircaft's design, and any survivabilicv enhancement 


A 
ab 


a) 


feature that reduces the amount and effect of damage iniuc 


by an enemy's weapon systems damage mechanism 


in 


Vulnerability is influenced by the ability of a sy 


as 


Pe as 
Gee sl. 
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continue to operate after being hit and by design features 
and equipment that prevent or suporess damages. Aen Lg a 


control system that continues to function arter sustaining 


sv 


hit by a damage mechanism on one of its components is an 


example of reduced aircraft vulnerability. 


B. SURVIVABILITY ENHANCEMENT CONCEPTS 

Survivability enhancements have b24n génerally 
categorized as any feature of an @ircrart, any zauiomernt 
carried, any tactic employed, or any combination schereof 
that reduces the susceptibility and/or th2 vulnerability of 


ane clacratt. Survivability enhancements can be separately 
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Bemeeme rd ed ano saithes “susceptibility reduction fea-ures 
or vulnerability reducticn features. Thosé specific 
susceptibility and vulnerability reduction features can be 
Summarized generically inte conceptual elements. Thee 2aest 
of the two categories relating zhe major survivabili«y 


2nhanceméent concepts is listed in Table I. 


TABLE I 
Survivability Enhancement Concepts - Susceptibiliry 


Reduction 


(1) Signature Reduction 

(2) Warning Receivers 

(3) Electronic Countermeasures Dévices 
(4) Expendables 

(5) “Tactics 


(6) Threat Suporession 


As presented in Table I, SMES GUICT=Shewhan aarerait's 
Susceptibility can be brought about by decreasing its 
detectability through signature reduction. Reducing an 
aircraft's ability to be detested and tracked by an enemy 
Can best be accomplished in the d2sign process. 


Incorporation of quieter, smekeless engines, ntilizing radar 


Ay 





absorbent materials, eliminating sharp edges (corner 
reflectors), and prescribing low IR reflestive paint schemes 
crew Oo 


are examples of this technique. Alerting che 
impending missile 29© gun activity can be achieved “through 


*he use of appropriately selected warn: 
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Incorporating electronic countermeasures dévices, such as 


noise jammers and decepticn repeaters, can degrade or 
preven= an enemy's defensive systems abilizcy to achi¢veé a 
suitable weapons firing sclution. Expendables, in the form 


of chaff, infrared flares, and off-board decoy devices, can 


confuse and degrade an enemy's weapon systems by masking an 


@ircraft's true identity cr location. (ePneaMs Zacion Of 
exposur2 to an enemy's defensive network can be achieved 
*hrough a suitable selection of tactics alternatives. 


Examples of this *chnique can be found in opsrationii plans 
that take advantage of terrain follo#wing/terrain masking 
ferght profiles aoe wenat utile ze Stamd-Off 2 
launch-and-leave weapons. [re iiipact s£ screw skzil and 
experience and the increased performances capaoilicties of the 
modern fighter/attack aircraft, brought about, in part, by 
the incorporation of FBW flight control systems technology, 


can have a major impact oon tactics selection. Threat 
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Suppression, the ability to actively deny the enemy an 


unhindered opportunity to fire his weapons, can b 


by attacking his 
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weapons emplacements with such means as 


antieradiation missiles and coordinated Supporting fire from 


ancillary units. 


The six cencepts described above comprise susceptibilicy 


meauect:On, the 
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dual are six vulnerability reduc 


avoidance portion cf the survivability dual. 
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concepts. These six complementary concepts are presented in 


Table II. 


TABLE If 


Survivability Enhancement Concepts - Valnerability Reduction 


(1) 
(2) 
(3) 
(4) 
(5) 


(6) 


Component Location 
component Shielding 
Component Redundancy 
Component Elimination 
Passive Damage Suppression 


Active Damage Suppression 


Vulnerability reduction can be best achieved in the 


design phases of an aircraft's development. Uitdisious 


Sele c220n ~One the la>cation of critical coffponents to minimize 


i? 





the possibility of. damage and shielding thos nit Cam 


iD 
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components to prevent damage mechanisms from striking «ne 
components, rendering them unsérvicable, are techniques nest 
suited to be achisved during the early design ovhases. 
Incorporation of more than one componsnt to parform a 


critical function (component redundancy) can nave = major 


a 


Memeeet on the vulnerability of ar aircraft or aizezat< 


t 


system. Additional reductions may be acthiaved through czhe 
elimination of components entirely (conponent eliminz=icn). 
Dassive and active damage suppression reduc2s aircrafz 
vulnerability either by controlling the =ffects of damage 
m2chanisms or by reducing or preventing «=h2 subsequent 


spread of furtker damage causing effects. 


j-4- 


th 
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Suitable attainment of an appropriate level of 2 
Survivability can be achieved through the incorporation of 
elements from gach of the survivability enhancemen* concepzs 
described. However, Heep use De Nnotsi~chee not 2ll 
Survivability enhancement concepts are necessary or 
appropriate for any particular aircraft type on any 
particular mission. Paradoxically, ae 22dnesion in 
vulnerability may lead to 4 greater degree oF 


Susceptibility, such as the case faced by the d2sign2r when 
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adding large amounts of armor plate to an aircraft, -«nereby 
increasing the ability to tolerate a hit, but making 


PeOVeaSouC lng + 


fe 


aircraft more susceptible to being h 
speed. Consequently, the sarly identification and 

successful incorporation of those survivanility enhancement 
features that most significantly increass 
@eeene]e altcrart's flight control system and increase the 
Mission 2ffectiveness sf the combat aircraft as 


system is to be regarded as 4 goal of th2 Survivability 


discipline. 
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III. FLIGHT CONTROL SYSTEMS 


A. PeeGut CONPTRCL BASICS 

Mmerdnee path COlerok cL an airereft is accomvoiished by 
means of a complex series of sleéectrical, hydraulic, and 
mechanical devices collectively titled tha fFfligh= control 
system (FCS). These basic ¢l2ments, when transformed into 
sensors, Signal paths, actuators, ani surface panels, 
provide the means by which «he pilot commands an aizcref- 


in-flight about the three axes of motion. 


iD 


Conventional military aircraft utilize three primary 
control surfaces t> control the three dimansional motion of 
*he aircraft: the elevators, the rudder 2nd the ailsrons. A 
Tight-hand orthogonal axis ee and the motions produced 
by the associated control surfaces are illustrated in Figure 
Beel.. 

Deviations fron the basic control surfaces ars functions 
of the geometric shape of the aircraft. In some airccraft 
configurations, the elevators are replaced by a solid 
horizontal tail, designated eithar a stabilator of 
stabilizer by the nanufacturer, which moves as a Single unit 
mompGavide piteh control. In some aircraft, zhe cail 


Surfaces can be controlled 2ither syanamstrically or 
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Figure 3.1. Reference Axes/Control Surface Deflections 


assymmetrically to provide pitch and roll control. Eyes 
type of tail surface is known as a differential stabilatorc. 
Tailless aircraft employ elevons in place of ailsrons and 
elevators to provide pitch and roll control. Flaperons 
replace ailerons in still other designs. 

Additional surfaces, such as specdbrakes, spoilers, 


leading and trailing edge flaps, and leading edge slats, are 





classified as secondary or auxiliary control surfacé¢s. 
These devices provide an aircraft a means of speed and 
peeect Lift control, and can be used as back-up Gar erod 
surfaces. Despite the nomenclature and physical 
differences, ‘the primary function of 32 particular control 
system configuration remains +9 guide the aircraf* in three 


dimensional flight. 


B. MECHANICAL FLISHT CONTROL SYSTEM BASICS 

Conventional flight control surface movements are 
commanded by the pilot through the control column and 
control pedals. Movement of the elevator and ailerors is 
commanded by means of a stick or wheel controller, and 
movement of the rudder is prescribed by a2 pair of rudder 
pedals. The basic mechanization schem2 is illustrated in 
Figure 3.2. The control column and rudder pedals are 
mechanically linked to the control surfac2s by cablés, 
pushrods, and belicranks as illustratei in Figure 3.3 for a 


longitudinal control system. 


C4 POWER-ASSISTED CONTROL SYSTEM BASICS 
Most high speed military combat aircraft require some 
form of powered flight control system to give the pilot 


adequate centrcl of the aircraft throughout the fligat 
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MECHANICAL POWER AND CONTROL: 
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Figure 3.2. Mechanical Flight Control Yechanization 
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Figure 3.3. Mechanical Longitudinal Control System 
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envelope. Conventional power-assisted control system 
designs usually derive the additional power by means of 
hydro-mechanical devices. the fundamental configuration is 
depicted in Figure 3.4. The hydraulic pump, selector valve, 
serveactuators, and associated plumbing, while adding weight 
and complexity to the control system, provide the additicnal 
power required. Artificial feel devices are generally 
incorporated in the mechanical linkage to provide feedback 
eo the Palot. Figure 3.5 illustrates the basic 
mechanization of a conventional hydraulic powered 


longitudinal control systen. 


D. mer-SY=WLRE (FBW) CONTROL SYSTEM BASICS 

Many modern, high technology combat aizcraft employ 
fly-by-wire flight control systems. In the basic 
Gomer@eration, illustrated in Figure 3.6, the pilst is 
linked to the control actuators by electrical wires. 
The electrical wiring provides the control signal paths that 
transmit the pilot's commands to the servoactuators. 
Sophisticated artificial feel devices provide feedback tc 


the “palot. The basic FBW control system configuration 


+ 
(A 


electrically noisy, and the aircraft is prone +o pilot 


wrducea Osé1llations. Toeraid in cCwe conmerollability cf tis 
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CONVENTIONAL HYDRAULICS: A centralized system with 
engine mounted pumps to 
supply hydraulic fluid 
through metal lines at 
3000 psi. 
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Figure 3.4. Hydraulic Power System Mechanization 


aircraft, a series of electronic filters is often inserted 
in the system between the pilot and the elactro-mechanical 


selector device to reduce nois2 transients. 


Ee COMPUTER AUGMENTED FBW CONTROL SYSTEM BASICS 
High speed computers, in-line with th2 basic FBW flight 
control system, may be used to either augnent or provide the 


Sonecollapalicy Of the aircraft. Computer monitoring of the 


ml 





Cemtrol stick 


wy Gontrol 
Bob Weight Surface 
Ree vire la) 
Feel Spring Push Rod 
>” Cables Trim Motor Hvdro-Mech 
\4 Valve 





Fore/Aft Cable Quadrants Hvd Surface 
Actuator 


Figure 3.5. Hydraulic Powered Longitudinal Control Systen 


flight environment through the addition of motion and rate 
sensors coupled to the ccmputer relieves the pilot of the 
responsibility +o continucusly monitor his flight path. 

One of the most sophisticated applications of a digital 
computer augmented FBW flight control system in a military 
combat aircraft is the McDonnell-Douglas F/A-18 "Hornet." 
This aircraft employs high speed digitai computers in-lins 
With a state-of-the-art FBW system to provide the very 
latest in high performance aircraft flight control systems 


technology. 
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FLY-BY-WIRE: The conventional mechanical linkage 
between the pilot's control input 
and mechanical controller is replaced 
by an electrical signal used to 
activate the control surface actuator. 


HY DRO-MECHANICAL 
ENGINE PUMP VALVE ACTUATOR 


PILOT ELEC TRO-MECHANICAL 
CONTROLLER 


Mechanical 
Hydraulic = sane 
Electrical Mets, 





Figure 3.6. Fly-by-Wire Control System MSechanization 


mew aunc-10Miel Gesigm ce “he F/A-18 Digital Fly-by-Wire 
(DFBW) flight control system is illustrated in Figure 3.7. 
The basic mechanical and electrical FCS subsystems are 
diagrammed in Figure 3.8. The basic hydraulic FCS 
subsystems are depicted in Figure 3.9. Note the néechanical 
back-up componen«s for controlling the pitch and roll notion 


Of the aircraft. 
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Figure 3.7. F/A-18 FCS Functional Diagram 
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Figure 3.8. 





Figure 3.9. PF/A-18 FCS Hydraulic Subsystem Diagran 
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EVs FCS MALEURE/EAMAGE MODES IDENTIFICATION 


SS So aes = ae ES SS SS Se a ez SS oe aaa ep ap =n 22 aut ae 2 ee Ge Ge Ge @e wesw 


A. Seoc EM VOLNERABILITY CONTRIBUTIONS 

Each individual component of an aircraft has a level of 
vulnerability that contributes to the overall vulnerabiliczy 
or the aircraft. Certain components contribute mors than 
others, and thos components which, when damaged or 
destroyed, léad to an aircraft loss are the ones of interest 
here. These components are known as critical components. 
The systemmatic identification of the scritical conponerits 
and the quantification of the vulnerability of individual 
components is a part of the overall aircraft vulnerability 
assessment. As the vulnerability contribution cf each 
component, subsystem and system is assess2d, various methods 
may be implemented to reduce the overall aircraft 
vulnerability. The vulnerability reduction technigue?(s) 
chosen for implementation in the FCS must allow the FCS 
design to remain within the constraints of cost, weight, 
performance, accessibility, and maintainability, et cetera 


imposed by contractual agreement. 
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B. [DENTE FICATIONW OF CRITICAL COMPONENTS 
One purpese of a vulnerability assessment is the 
identification of those components whose damage cr loss 
could lead to an aircraft kill. A gén2ral procedure hes 
been formulated for determining the criticai components, 
their possible damage or failure modes, and the effects of 
the damage or failure on the continued operation of the 
aircraft [Ref. 1]. 
Fundamentally, the procedure is comprisea of three 
steps: 
(1) selection of an aircraft kill level. 
(2) formulation of a complete technical and functional 
description of the aircraft. 
2) Wer edentitication and delineation cf the critical 
compcenents. 
1. Aircraft Kill Levels 
Combat damaged aircraft and aircraft systems suffer 
performance degradations in varying degreés. The level to 
Which the performance degradation progresses can, ier 
g2neral, be categorized as an attrition kill, a mission 


Soer=. Kill, or a force®d landing kill. 
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Masa on ke) a aS defined as shat measur 


fh) 


Gioa 
aircraft damage that results in the loss of the aircraft 
from the inventory. Repairability and economy of repair are 
Beetors which may contribute to to an attrition kill without 


the physical loss 9f the aircraf*. Howewes, it 1s th 


DP 


elapsed time from damage onset to eventual aircraft less 


mien provides the scale with which to differentiate between 


attrition kill levels. Several attrition kill levels haves 
been defined; such as "KK", "K", "A", and "Bt, impressed on 
a time tc aircraft loss scals. Detailed kill level 
d2scriptions are contained Within DOD 


MIL-STD-336-1 (Ref. 2]. 

A mission abort kill is deéfinei as that measure of 
aircraft damage which results in an aircraft failing to 
complete its assigned mission, but that dees not result in a 
loss of the aircraft from the inventory. 

A forced landing kill, specifically applicable to 
helicopters, VTOL, and certain V/STOL aircraft, is defined 
as that measure of aircraft damage that causes the piloz to 
land his aircraft short of the intended l@stination, and the 
failure *o do so would result in the dastruction of the 


aazcrackt. 
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2. igeraft Technical and Functional Deserinzica 

At each successive stage of the aircraf+ design 
process, the technical and functional descriptions oF 
aircraft systems and compenents become better defined. 
These descriptions, with individual component ard systems 
dimensions, materials, operations and functions interfaces, 
scale and perspective drawings, amd aitrcrat.= logatior 
profiles, comprise tne detailed technical base for use in 
the vulnerability meee Vent. Gathering and continuously 
updating this data base, as it is formulated, should be 
given a very high priority. 

3. Critical Component Identification Procedurs 

A sequenced procedure has been formulated to 
identify the critical components [Ref. 1]. The first step 
in this analysis oarocedure for the FCS is to identify «he 
flight essential functions that the FCS must perform in 
order to continue to accomplish the aircrafz='s mission. The 
second step is to identify those FCS subsystems and 
components that provide or perform the 2ssential functions. 
The third step is to conduct a failure mode and effects 


analysis (FMEA) and/or a fault tree analysis (FTA) ‘to 


identify the relationship between the individual component 
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or subsystem failure and the essential function(s} it 
provides or performs. The fourth step, th2 damage modes and 
effects analysis (DMEA), consists of relating th? componen+ 
or subsystem failure modes to combat damage causé:s. The 
final step in the process, the presentation of the rasults, 
is often expressed ina logical séquencs known as 2 kill 
expression, or represented graphically as a kill «ree. 


4. Procedural Example 


Generic DFBW FC 


lw 


To illustrate this dynamic process, ane Liigns 
Cent rol system of a generic fighter/attack aircraft will be 
utilized. The time scale of a "B" level attrition kill will 
be imposed for illustrative purposes. 

A schematic representation of ths 2xempl2 DFBW FCS 
layout 1s shown in Figure 4.1. Specific +t¢chnical and 
functional interfaces are depicted in Figur2 4.2. The FCS 
utilizes dual, high speed digital compiaters, quadruple 
*ransmission signal paths, two independent hydraulic 
systems, and dual, tandem hydraulic actuators at all control 
surfaces. No back-up mechanical control linkage is 
provided. 

Flight essential functions ar2 those that aré 


required te sustain controlled flight with qualities no 


c+ 
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Figure 4.1. Generic DFBW FCS Illustration 


less than level 3 as defined by MIL-F-8735C [Ref. 3]. Each 
Mission phase constitutes an evaluation point in the 
process. Mission phases for a typical multipurpose 
fighter/attack aircraft include takeoff, climb, outbound 
cruise, descent, target inaress, ordnance delivery, target 
egress, climb, inbound cruise, descent, and landing, as 
Shown in Figure 4.3. Figure 4.4 delineates those flight 
essential functions in atypical format for the example 


fighter/fattack aircraft. 
oy 
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Figure 4.2. Technical/Functional Interfaces - DFBW FCS 


To fly and conduct the aircraft's mission requires 
On 


VU) 


the continued operation cf those supporting systen 
perform the essential FCS 


Subsystems that provide of 
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Figure 4.3. Fighter/Attack Mission Profile Phases 


ene + 2ON . The level of severity and time criticality of 


iD 


loss of these supporting systems or subsystems must b 
evaluated during this process step. Figure 4.5 depicts a 
Sample tabulation of some of those major supporting systems 
and subsystems. In depth and detailed analyses of ¢ach 
individual supporting element must be carried out as €ach of 
these elements becomes sufficiantly defined during the 


d2sign process. A sample tabulation of a more detailad 


analysis is presented in Figur2 4.6. 
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Mission Te Provide Controlled : Provide Continuous 
Phases ‘ Flight . System Status 
é ; Monitoring 

Takeoff : x x 
Climb 2 x x 
Cruise r x : x 
Descent : xX “ X 
Target : xX : X 
Ingress : : 

Ordnance : x ‘ x 
Delivery : 2 

Target : x : x 
Egress : : 

Climb ; x x 
Cruise ‘ x ; x 
Descent - Xx - Xx 
Landing : xX : xX 


Figure 4.4. FCS Essential Functions vs. 4ission Phases 


Continuously updating the technical and functional 
da<q@ base provides the basis and means tor furthsz 
refinements of the detailed supporting systems analysis. 

The third phase in the analysis procedure is the 


failure mode and effects analysis and/or the fault tree 


analysis. The FMEA is a "“bottoms-up" orocedure that 
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Supporting - Provide Controlled . Provide Continuous 
System/Subsystem . Flight . System Status 
Functions ‘ - Monitoring 

Electrical : x : X 

Power ° : 

Hydraulic = x : 

Power ° : 

Airconditioning/. ‘ 

Environmental ; x : 

Control : : 

Motion Sensor : x ; 

Input : ; 


Pigure 4.5. Basic Systems/Subsystems Supporting The FCS. 


identifies all possible failure modes of a component or 
system, documents these failure modes, and determines «he 
effect of each failure mode on the performance of the system 
as a whole. The details of the FMEA process, and specific 
procedures can be found in MIL-STD-785 (Ref. 4]. 

Component failure modes generally considered in an 


FMEA include failure to operate, failur2 +o terminate 
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Detailed 3 : 

Supporting - Provide Controlled - Provide Continuous 
System/ . Pleragnt - System Status 
Subsystem : - Monitoring 
Functions : ; 

Generate ‘ 

AC/DC Elec ‘ x , Xx 
Power - ; 

Distribute 7 : 

AC/DC Elec ; Xx : x 
Power ‘ 

Provide : : 

Auto Elec xX . x 
Cte Protect . i 

Provide . ‘ 

Battery ; x ; X 
Power : 

Generate ‘ : 

Hydraulic ° xX i Xx 
Power ; 5 

Distribute z ; 

Hydraulic é X : xX 
Power ; ; 

Provide ; 

Hyd Fluid ; xX ; xX 
Level Sensing. ; 

Provide Poe : 

Aircond/ : X ; X 
Environ Ctc . é 

Protection 2 : 

Provide Pe , 

Continuous 5 x ; xX 
Transmission . - 

Signal Path . j 

Provide ; : 

Continuous 3 Xx ; Xx 
Sensor Input . ° 


Figure 4.6. Detailed Support Systems/Subsystems Analysis. 
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operation, prematurs operation, aid degraded or 


out-of-tolerance operation. Unique failur> modes may be 
Singularly inserted in this stage of the process. A 


2xample¢ FMEA summary report for a hydraulic control surface 


actuator for the example FCS is presented in Figures 4.7. 
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Aircraft Subsystem Failure Effect on Effect of Aircraft Supporting Comment s 
System Component Location Mode Subsystem Degraded Kill References 
Subsystem Category 


on Aircraft 


ETC. Hyd. Act. Vert. Stab. Jammed Rudder Balanced "B": #1,5,7 2,4 
Controls #XXXX Hardover flight aircraft 

obtainable uncontrol- 

with cross- lable in 

control; landing 

aircraft configuration 

uncontrollable 


in PA config. 


Severed Rudder Balanced ---, aircraft #3 6 
Trails flight can fly and 
obtainable land with 
with cross- other control 
control or surfaces 
differential functioning 


engine power 


Figure 4.7. Example FMEA Summary Report - Hyd. Actuator 
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Phwewacewatot becomes a Critical componenz ‘for an 
Mereat2on Kell if it jams the control surface into a 
hard-over condition, but it is not a critical Perpenent 
it allows the control surface to remain unjammed. 

Another analysis procedure, the Fault Tree ieee eee 
employs a "top- down" approach [Ref. 5]. This approach 
dirfers from the FMEA in that i+ assumes an undesired event 
and systematically determines what failure o> seguence of 
failures could cause the undesired outcome. A segment of an 
FTA for the example FCS is presented in Figure 4.8. The 
Symbolegy utilized in the FTA analysis 1S common t9 logic 
systems and, as such, the FTA is often selected for its 
Suitability with computational systems. 

P@omcaair= SWodes that cculd result in airczar 
attrition have been identified for the 2xample FCS and are 
presented in Table III. 

The FMEA and FTA related failure modes and effects 
but did not distinguish the possible caus4(s) of ne 
eta bure. The Danage Mode and Effects Analysis (DMNEA) 
provides this essential relationship. In the DMEA, the 
component and subsystem failures are related to specifi 


damage causing mechanisms and damage processes. Included in 
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Figure 4.8. A Segment Of An FTA For [he Example FCS. 
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TABLE LIT 
Example FOS Failure Modes - Attrition Kill 
(1) Loss of control inputs 
(2) Loss of motion sensor jiata 
(Om Veoss ct digital compucsr coatrol 
(4) Loss of electrical power +o computer (s) 
(5) Loss of control signal path 
(6) Loss of hydraulic systém power 
(7) Loss of control surface actuator 


(8) Loss of control surfaces 


these primary damage mechanisms are projectiles and 
fragments, blast effects from high explosive warheads, 
incendiary particles, and High Energy Lasers (HEL). The 
damage these agénts may cause includes severed electrical 
power distribution lines, sensor signal paths, and control 
signal transmission lines; jammed mechanical linkages and 
s2rvoactuators; loss of hydraulic pressur2 and hydraulic 
fluid loss/leakage; fire (aggravated by petroleum based 
bytetalic fluid: HEL burn-through and high temperature 
heating or melting of FCS components, and certain 
electromagnetic incompatibilities with components, devices, 


cables, wiring, and connectors. Secondary damage mechanisms 
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resulting from the impact of the primary agents on «he FCS 


include fire, explosion, Spalling, strustural defornation 


* 


sparks, and fluid leakage. The DMEA process evaluates cause 


and effect, and quantifies the likelihood of thse oute 


Oo 
rc 
iD 
e 


Secondary damage causes, resulting from the primary damage 
mechanism or process, are included in the evaluazion during 
this analysis phase. Detailed descriptions of the 
vulnerability assessment quantification process arse 
resented in reference 1 and in MIL-STD-336-1 [Ref. 2]. 

Failure modes can be categorizad and qualitatively 
aligned with the various damage causing i2vices or events. 
Figure 4.9 correllates the example FCS failure modes 
presented in Table III with common conventional weapons 
damage causing agents. 

The next step in the vulnerability assessment 
process is the actual determination of the critical 
components for the selected kill level assessed. 
Distinguishing between redundant and non-redundant critical 
components is essential in this phase of the analysis. TO 
GCle@riey thas beportant diStinction, a set of components is 
fait med to be redundant if the loss of one or more than one, 


but not all of the components, does not rasult in the loss 
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Failure/Damage Modes Camage Mechanisms 





Penetrator | Continuous Rod | Fragment | Blast | Fire | Radiation 


Structural Failure Modes 


Area Removal X X xX X X 
Overpressure X 

Thermal Degradation X X 
Penetration X X x 


Electrical Power System 
Failure Modes 


Line Severance X X X Xx X X 
Grounding X X x X X X 
Avionics System Failure 
Modes ; 
Failure to Operate X X X X x X 
Degraded Operations xX xX X X X X 


Hydraulic Power System 
Failure Modes 


Loss of Fluid X X X X X X 
Loss of Pressure xX xX xX x X x 
Jammed Actuator xX x xX x X 


Figure 4.9. FCS Failure Modes/Damag2 Causing Agents 


of the essential function these components perform. If this 
distinction can not be made, the components are 

non-redundant. AS an example, the quadruple control signal 
paths shown for the example FCS form a multiply redundant 


System because the essential function of providing a 
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continuous signal path 1s maintained evan though ons or more 
than one individual path may be rendered discontinuous. 

Ancther distincticn regarding redundancy must ke 
made. The term “analytical redundancy" refers to a method 
whereby a computational algorithm is used to predict an end 
event or parameter. Then the prediction and 2 s2ns0r 
d2rived measurement are compared, and subsequent action(s) 
taken. Wie Not Lattang the © precise definition of 
redundancy, the computaticnal results can be suitably used 
in lieu of the sensor output in certain circumstances. 

The determination of the critical components and the 
presentation format are often presented ina "kill tree" or 
“Kill expressicon."' Referring to that portion of «ne kill 
tree shown in Figure 4.10, the physical relationship «+o a 
*ree 1s apparent. The severance of sufficient trunk 
segments may result in the loss of the tr2e¢ and in the case 
of the FCS, the loss of the aircraft. 

Once identified, the critical components may be 
subject to various engineering redesigns to reduce their 


contribution to the vulnerability of the aircraft. 
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Figure 4.10. FCS Conventional Weapons Kill Tree 
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V. FCS SURVIVABILITY DESIGN GUIDELINES 


A. GENERAL FCS CESIGN PRINCIPLES 

General design principles to reduce vulnerability should 
be exercised to the fullest extent possible throughout «he 
FCS design process. Commencing with the initial design 
phases, a full measure of consideration must be given tc the 
combat survivability of the flight control systéen. 0€ 
course, the desire for increased survivability of *h= fligh= 
control system must be prudently balanced with che other 
requirements of reliability, maintainability, accessibility, 
repairability, and safety. Concurrently, the fullest 
measure of performance must be achievei, and all these 
factors must be suitably combined within stringent cest and 
weight constraints. In the end, the design of the FCS of 
military combat aircraft must include suitable protection 
from the primary damage causing mechanisms of conventional 
threat weapons systems. 

The six survivability enhancement concepts developed in 
Chapter II (Table II, page 19) provide th foundation for 
the general FCS design principles. In general, the FCS 
d2sign principles contain provision for component location 


and shielding to reduce potential damage risks; elimina-ion 
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(via redesign) of high risk, Sengaie Domne. failure 
components; component redundancy with adéguate separation of 
redundant components to maintain the 2ssential flight 
Gontrol function; and the incorporation of passive and 
active damag¢é suppression devices and t2cshniques te minimize 
the effects of incurred damage. BR tlzght centrol systen 
design that includes no single point kill possibilities 


should be considered a design goal. 


te SURVIVABILITY DESIGN GUIDELINES FOR FBW FCS 

Specific survivability design guidelines applicable to 
the individual conponents and subsystems of a Fly-by-Wire 
Flight Control System have been formulated and arse herein 
presented. The decision *o incorporat? any or all of the 
design guidelines must be made prudently and with sound 
engineering judgement. 

1. Mechanical System Components 


a) Flight Control Surface Panels 


Where possible: 


e Design control surface pane is of lightweight 
composite materials which exhibit high 
strenqth-to-weight ratios and integral 
Feamodant ogd CAErying sapability for higk 
ballistic damage tolerance. 


@e Incorporate smooth surface transitions to 
reduce aircraf* signatures. 


e Incorporate multiple surface panels on each 
Coneso! Plane 23> provides _redundan* control 
surfaces for maximum reconfigurability. 

e Utilize heat resistant surface material or 
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b) 


c) 


ablative materials to retard HEL burnthrough. 


Hinges/Control Linkages/Bearing Assemblies 


Where possible: 


Design components to be jam-frée. 
( 


Utilize self-aligning bearings a 

trt= pe wot scary gs) to minimize misalignment 
and Jamming due to control r5d, éctuator arn, 
oz sontrol surface panel deformation. 


sam, 
—_ 
~~ @ 


Minimize the length of mechanical control 
linkages to reduce the probability of 
deformation or distortion. 


Utilize ballistically damadq 
composite materials for ¢ 
torque tubes. 


e tcleranr= 
ontrol rods and 


Design fairleads, bellcranks, and idler, 
assemblies to allow a_ measure cf functional 
performance if damaged. 


Install primary drive motors, control 
linkages, interconnecting devices, and 
bearing assemblies in cl3s@ proximity to 
primary structural members to take advantag=s 
of the shielding afforded by the rimary 
structure. 

Ensure that that all contrs 
fitted with a "trail saf3". 
tq prevent Nagpaower conditi 
of the loss of the drive lil 


1 surfaces are ,. 
positioning device 
Ons in the event 
nkage. 


Servcactuators 


Where possible: 


Design all servoactuators with redundant 
pewer sources (e.g. dual cylinder actuators). 


Design actuator pistons of frangibl¢ or 
Malleable materials to Minimize the 
possibility of jamming. 


Design actuator barrel assemblies of high 
strength steel for high ballistic resistance 
e.g. Electro-Slag Remelt (ESR) Steel). 
= 


Pesign the actuator outer-barrel assemblies 
to pfevent crack fpropogation. 


Install servoactuators in close proximity tc 
primary structural members for maximum 
Shielding. 


Install rate ae poss =2 0 feadback linkages 
i 6=6hGleOem Proxamrty tO he servoacruator 
assembly for maximum shielding. 


(iD tp 
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2. Hydraulic Power Syst 


a) 


b) 


Utilize integral reservoir, pump, an 
electric So ae packages when possible (¢.gq. 
Integrated Actuator Packages (IAP)). 
Incorporate metallic seals in place of 
polymeric seals for HEL protection. 


Coat actuator housings with high tempesratu 
resistant or ablative materiéls for HEL 
burnthrough protection. 


Incorporate high strength ablative armor in 

areas of critical components. 

Incorporate very, high signal-to-noi 
2 


mac © 
servovalves for increasei EMI tol a 


Ss 
ane 


Ith 


Q 


1A 


Tt) 


Fluid Pressure Generation Subsystems 


Where possible: 


Design hydraulic power sourc2s to be single 
or double redundant (¢.g. separate dual or 
triple hydraulic power Z5urces} . 


Physically separate hydraulic power sources 
as much as possible to reduce the single shot 
kee @peobabality of a @W@itiple hydfaulic 


systen. 


Install power sources in close proxinit+y to 
m@éin structural members to provide maximum 
shielding. 


Incorporate high_ temperatura resistant or 
ablative material coatings on hydraulic pump 
cas?s t> increas? HEL burnthrough tolerance. 


Fluid Pressure Distribution Subsystems 


Where possible: 


Design fluid pressure distribution systems of 
high strength, high temperature tolerant 
steel lines. 


Incorporate single or double redundant 
distribution lines on each separates fluid 
pressure systen. 


Dace porat e, flow sensors, check valves, and 
Switching circuits to bypass damaged segments 
of distribution lines. 

Incorporate reservoir level eas omy Lome 
to isolate damaged distribution Lines to 
prevent fluid loss. 


Install distribution lines in close proximiczy 
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to. main structural menbers to maximize 
shielding. 


tilize very high pressure (1.2. 4000-6000 
psi) systemS to reduce presented area. 
Utilize high temperature resistant 
Synthetic-based draulic fluid to reduce or 


eliminate fire potential. 


3. Electronic System Components 


a) 


b) 


Flight Control Avionics Components 


Where possible: 


Design all primary FBW FCS avicnics 


components with multiple redundancy (¢€.q. 
multiple LVDT control input ssnsorsS_9n,eéch 
control axis input, an Mees ple diaqitel 


flight control computers). 


Separate redundant avionics components to 
Minimize single shot kill probabilities. 


Design all avionics component cases_of high 
strength steel for maximum ballistic 
resistance. 


Coat all avionics compon2nt cases with high 
temperature resistant or ablative naterials- 
for maximum HEL burnthrough protection. 


Design shock moynts for internal and_external 
components to withstand vibration and weapons 
induced shock loads. 


Install avicnics components in clos? 
proximity to_primary structural members for 
Maximum Shielding. 


Incorporate high +temperature resistant or, 
ablative armor in areas surrounding critical 
components. 


Design electronic compon2nts with suitable 
particulate, vapor, and noisture protection. 


Electronic Circuit Design 


Where possible: 


Design iNpuc/output circuits of very high 
Signal-to-Noise (S/N) ratio components for 
maximum EMI protection. 


Minimize capacitive and inductive . 
cross-coupling in electronic circuits. 


Incorporate suitable self-protect, enargy 
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c) 


d) 


€) 


dissipative circuits to provide lightning and 
EMI/EMP protection (e.g. fusible links, 


filters,or spark-gap devices). 

Provid? separate and redundant analog 
channels, with separate voting logic, as a 
backup to the digital controllér. 


Signal Transmission Paths 


Where possible: 


Design Single or double redundant signal | 
paths between each component or elemenz in 
Signal path. 


}v 


Provide suitable separation between redundancz 
Signal transmission linss +o recuce the 
Single shot kill probabili*y. 


Route signal transmission lines in cicse 
proximity to pan ery Structural members for 
maximum Shielding. 


Provide adequat?S electromagnetic shislding to 
reduce EMI. 


Utilize high temperature resistant wires | 
covering tO maximize thermal/fire protection 
and to minimize HEL burnthrough. 


External Sensors/Ancillary Subsystems - 


Where possible: 


Design multiple redundanz external sensors 
and ancillary subsystems ea Air Data 
Computers, and Angl® of Attack systems). 


Incorporate high. temperature resistant or 
ablative material armor for cthermai, HEL and 
ballistic damage tolerance. 


Provide separats, redundant motion and rate 
sensors on each of the three aircraft axes. 


Mount sensors to. primary structural members 
for maximum shielding. 


Provide analytically redundant oot 
eae for use as checks, and as potential 
back-ups. 


Provide adequat) built-in test circuits with 
Suitable failure warning indications. 


Incorporate separate and widely displaced 
sensor Signal transmission paths. 


Pilot Control Inputs 
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Where possible: : 





® Deseon tedundane control stick and rudder 
input sensor contacts. 

e Utilize sequenced voting logic and multiplex 
control commands to _¢ach of the entral 
Pe@eessung UWhatS of th2 Elight ctntrol 
computer(s). 

e Incorporate separate and widely displaced 
imput command Signal transmission paths. 

4. Eleczrical Power Svsten 
a) Electrical Power Generation 

Where possible; 

e Design electrical power generation systems to 
be eee ae 2.gJ- dual generators, 
each with Single generator capability). 

e Incorporate multiply redundant AC/DC 
conversion elements. 

e Utilize autcmatic/manual or manually 
activated ram air turbines ¢mergency . 
generators, with separats AC/DC conversion 
elements. : 

e Design battery back-up systems.” 


b) Electrical Power Distribution 


Where possible: 


Design electrical bus distribution system 
for "cross-over" transient-free cperat: 


Incorporate redundant control signal/po 
wiring to IAP (if utilized). 


5. Environmental Control System 


Where possible: 


Design separate and redundant a priori 
distributed heating and _ cooling, 
tee ea tlie and volumetric flow Systems 
Swear tieGal Components (e.g. flight control 
computer(s)). 
Incorporate fail-safe temperature, pressure, 
and volume flow sensors (1.6. safe 
operating condition iS maintained should a 


failure Occur). 
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A. SUMMARY 

In summary, it has been the author's desire =o present 
in a single document a clear-cut set of guidelines for the 
development of aircraft flight control systems wizth specific 


emphasis on increasing the combat survivability of aircraft 


4 


equipped with FBW flight control systems. The material 


gn 


presented and the guidelines delineated have resulted in 


,v 


document that is as complete and concis2 as any single 
source document can be when dealing with a fast-paced, 
highly complex technical subject. This document should 
therefore be viewed as a dynamic ~001 that reflects a 
Gomernuous chain of ongcing thoughts ind actions to 
constantly update and strengthen the quality, capability and 


Survivability of the combat systems of our Armed Forces. 


B. RECOMMENDATIONS FOR FOTURE ACTIONS 

Enhanced survivability alternatives achievable through 
digital FBW FCS technology should be investigated fully. 
One such survivability enhancement alternative, achievabl: 
through digital technology, Psy a (sede -healing"’, 


reconfigurable aircraft flight control syste2n. 
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ct 


Consider for a moment that you are che pilio of an 
aircraft that has just been hit by enemy ground-firs. Me 
feel the dull thud as the enemy projectile impacts your 
Alrcraft's aft fuselage area and now you sense the aircraft 
beginning to fitch and roll without command. Your survival 
instinct tells you to try every possible combination of 
Stick and rudder input tc counter ths out-of-control 
aircraft motion. Nothing seems tO correct «the 
PeeetieetOn..+.....VYOUr final thought prior to ejecting from 
Geimestricken craft is "if only...-..." 

This hypothetical example is but on? of many possible 
combat related incidents that might be resolved in another 
way through the use of digital technology. Consider the 
possibilities afforded by digital technology in regaining 
control over a combat damaged aircraft as in the 
aforementioned example. Wor =~ ONG OL the hori zon tel 
stabilators gone, an alternat= combination of primary and 
secondary contrel surfaces might be commanded by the 
computer to return the aircraft to controlled flight. This 
proposed survivability enhancement alt2rnative could be 
obtained with minimal additions to present digital 


tay ua Waete Edicght controd configurations. The addition of 
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a sensor suite, ¢o detect and identify damaged flight 
control components, and a computational algorizthm to 
reconfigure the aircraft control surfaces, Similar in nature 
Pomchet uSed in artificially intelligent robot devices, ara 
all that is required. Without question, successfull 
achievement of such an adventuresome engineering task would 
require a dedicated effort. Outlined in the following, is a 
plan to accomplish such a project. It is the author's 
opinion that sincere thought and consideration should be 
given to such an undertaking in the near term. 

A plan to develop an artificially intelligent, 
reconfigurable flight control system would require detailed 
engineering analyses of the following arzas: 


@e Computational analysis, and wind tunnel determination 
of Se ee lift, drag and moment coefficients on 
Simulated combat damaged aircraft modeis (€.g. model 
testing of missing, ammed or trailing-fre2 control 
Surfacés in Ssinglé and multiple combinaticns). 


@e Development of control surface reconftigurabilit 
alternatives. 


e Development of suitable sensors t> datect the various 
levels and nodes of combat damage. 


@e Develcpment of a sequenced logic or built-in test | 
routine to veriry flight control system corfiguration 
and status. 


It is the author's opinion that the fundamental 
technology and expertise are present within the 


military-industrial community t*9 achieve the aforementioned 
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Survivability enhancement alternative at low technological 
risk and low cost. It is hoped that tomorrow's history do¢s 


not show the way to progress in aircraft survivability. 
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